What is the CVSS score of CVE-2026-45598?

CVE-2026-45598 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows AFD.sys are affected by CVE-2026-45598?

CVE-2026-45598 is a local privilege escalation vulnerability in Windows afd.sys (WinSock Ancillary Function Driver) with HIGH severity and CVSS 7.0 that allows any authenticated low-privileged…. A patch is available.

How to fix or mitigate CVE-2026-45598?

Within 24 hours: Identify and inventory all Windows systems running affected versions; prioritize critical systems and infrastructure. Within 7 days: Restrict local interactive logons and RDP access to essential personnel; enable privilege escalation detection and alerting; segment critical systems from general-purpose networks to limit lateral movement. Within 30 days: Monitor Microsoft advisories and CISA KEV for patch release; develop patch deployment procedures; apply patches to critical systems immediately upon vendor release.

Windows AFD.sys CVE-2026-45598

EUVD-2026-35558 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-cm8c-qx86-hm82

Denial Of Service Microsoft Race Condition Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:12 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged user to win a race condition and trigger a use-after-free, enabling code execution at kernel level. No public exploit identified at time of analysis, but AFD.sys has a long history of being a preferred LPE target and Microsoft has marked the issue as important. EPSS data was not provided in the source feed.

Technical ContextAI

AFD.sys is the kernel-mode driver that backs the Winsock user-mode API, brokering socket operations between user-space applications and the TCP/IP stack on every supported Windows release. The root cause is CWE-362 (concurrent execution using shared resource with improper synchronization, i.e. a race condition) that leads to a use-after-free: two threads racing on the same socket object can cause one path to free a structure while another still holds and dereferences a pointer to it. Because the dangling pointer is dereferenced in kernel context, controlling the freed allocation (via heap grooming of paged or non-paged pool) lets an attacker convert the UAF into arbitrary kernel read/write and ultimately SYSTEM-level execution.

RemediationAI

Patch available per vendor advisory - apply the Microsoft cumulative security update for your Windows build referenced on the MSRC page at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45598 as the primary fix; exact patched build numbers are listed only in that advisory and are not reproduced here to avoid inventing versions. Because exploitation requires local authenticated access, compensating controls until patching include restricting interactive and Remote Desktop logon rights on tier-0/tier-1 hosts (trade-off: blocks legitimate admin workflows), enforcing application allow-listing such as WDAC or AppLocker to stop unsigned LPE binaries from running (trade-off: high operational tuning cost), and enabling Microsoft Defender / EDR rules that flag suspicious AFD.sys IOCTL patterns and pool-spray behaviour (trade-off: detection-only, will not prevent fast exploits). Disabling AFD.sys itself is not a viable workaround because it would break all Winsock-based networking on the host.